aws-cdk-codepipeline: InvokeLambdaAction

[eladb]

1. Accepts a LambdaRef instead of function name
2. Add lambda:ListFunctions and lambda:InvokeFunction to pipeline role.
3. Add codepipeline:PutJobXxxResult to Lambda role.

In order to avoid the cyclic dependency:

Pipeline => Lambda
Lambda => Role
Role => Pipeline

We follow the recommendation in the CodePipeline docs
and use a "*" resource for codepipeline:PutJobXxxResult
for the Lambda execution policy.

BREAKING CHANGE:

• The DefaultBounds function is no longer exported.
• GitHubSourceProps.oathToken spelling fixed to oauthToken
• BuildAction now takes an inputArtifact instead of source (allows
  using these actions for arbitrary activity within a pipeline).
• InvokeLambdaProps takes lambda instead of functionName.
• InvokeLambda renamed to InvokeLambdaAction

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[RomainMuller]

Would put the URL on the same line as the @see.

[eladb]

I get yelled at by tslint 😢 and I don't like to constantly disable those rules.

[RomainMuller]

Just a though -- that default is slightly awkward (because undefined is falsey). But whatever.

[rix0rrr]

I think it's perfectly fine to have defaults that default to true. At least, better than negative keywords (dontAddPutJobResultPolicy? ugh)

[RomainMuller]

Definitely. Hence the whatever.

[eladb]

Yes, @rix0rrr convinced me of this when we formalized the design guidelines, and I am convert now.

[rix0rrr]

In order to avoid the cyclic dependency

Don't think that is the reason. We don't actually have a cyclic dependency, because we'd just use an IAM::Policy resource, making the dependency chain:

  +----------------------------------------------+
  |                                              v
+--------+     +----------+     +--------+     +------------+
| Policy | --> | Pipeline | --> | Lambda | --> | LambdaRole |
+--------+     +----------+     +--------+     +------------+

I think the reason is just that CodePipeline doesn't actually support ARNs in IAM policies! 🙀

[eladb]

@rix0rrr good point about the cyclic dependency. Let me re-check if there's something I missed.